Business Analyst
Information Security Governance, Risk & Compliance (GRC) - Requirements & Analysis
Role Purpose
Bridge business and regulatory stakeholders and the technical delivery team within the Information
Security Governance, Risk, Compliance & Assurance (GRC) domain. The Business Analyst elicits,
analyzes, and documents requirements; owns the Business Requirements Document (BRD); and
translates regulatory, control, evidence, risk, and workflow needs into transparent user stories, acceptance
criteria, and process designs for AI-enabled GRC solutions.
Key Responsibilities
Requirements ownership: Own, refine, and maintain the BRD and a clear requirements
traceability matrix from business need through to delivered capability.
Elicitation: Run workshops and interviews with GRC, Risk, Audit, Compliance, and Information
Security SMEs and business control owners to capture detailed requirements.
Process analysis: Document current-state vs target-state processes for compliance execution,
risk assessment, audit readiness, and evidence management; identify gaps and improvement
opportunities.
Control framework & taxonomy: Support definition and alignment of standardized control
frameworks and taxonomies; map controls across regulations and standards (e.g., ISO 27001,
NIST, relevant central-bank requirements).
Capability requirements: Specify requirements for regulatory ingestion (NLP), intelligent control mapping, workflow orchestration, the evidence lifecycle and reuse rules, risk-assessment engines, and executive dashboards/reporting.
Backlog & user stories: Write user stories with clear acceptance criteria and, with the Product
Owner,



groom and prioritize the backlog - helping focus proof-of-concept and MVP scope on
high-value use cases.
Functional & non-functional requirements: Capture NFRs including role-based access
control, audit logging, scalability, and integration with SIEM, IAM, and DevSecOps systems.
Vendor fit/gap analysis: Support build buy hybrid evaluation through structured fit/gap
analysis of candidate platforms (e.g., ServiceNow GRC, RSA Archer, MetricStream, OneTrust)
against business requirements.
Data requirements: Define data requirements and quality expectations needed to train and
operate AI/NLP models, in partnership with Data and ML Engineers.
Validation & UAT: Develop test scenarios and acceptance criteria, support QA and User
Acceptance Testing, and confirm delivered features meet documented requirements.
Change & sign-off: Manage requirement change requests, facilitate stakeholder reviews, and
obtain formal sign-offs at each stage gate.
Required Qualifications & Experience
Bachelor's degree in Business, Information Systems, Computer Science, or a related field.

Information Security Governance, Risk & Compliance (GRC) Confidential

Business analysis certification preferred - CBAP, CCBA, PMI-PBA, or an Agile BA / Scrum
credential.
5+ years of business-analysis experience, including delivery in GRC, risk, compliance, or
information security - ideally in financial services.




Strong requirements elicitation, process modeling (e.g., BPMN), use-case and user-story
authoring.
Experience producing BRDs, functional specifications, and requirements traceability.
Experience supporting vendor evaluation and fit/gap analysis against documented
requirements.
Technical & Domain Knowledge
Working knowledge of GRC platforms and control frameworks (ISO 27001, NIST; awareness of
central-bank regulatory expectations).
Understanding of compliance, risk-assessment, audit-readiness, and evidence-management
processes.
Familiarity with AI/ML and NLP concepts and the data requirements that support them
(preferred).
Comfort with backlog and analysis tooling (e.g., Jira / Azure DevOps) and process-modeling
tools.
Core Competencies
Exceptional written documentation and analytical rigor with strong attention to detail.
Skilled facilitator able to translate between business, regulatory, and technical audiences.
Structured, requirements-led thinking and the ability to prioritize for value.
Collaborative, proactive, and comfortable operating amid evolving requirements.
Preferred (Nice to Have)
Experience in banking or financial services within the UAE / GCC region.
Prior exposure to AI/ML or NLP projects and to agile delivery.
Success Measures
Clear, complete, and traceable requirements that the delivery team can build against with
minimal rework.
Well-prioritized scope focused on high-value, defensible use cases.
Accurate control mapping and evidence/workflow requirements that reduce duplication and
support reuse.
Successful UAT and stakeholder sign-off at each stage gate.

📌 Business Analyst (Bengaluru)
🏢 TRIGENT SOFTWARE PRIVATE
📍 Bengaluru